Senior Application Security Engineer: Secure SDLC Leader

Nebius Group; United States; Remote; USD 140,000 - 190,000; Full time

Job summary

Nebius is seeking a Senior/Staff Application Security Engineer to safeguard our cloud platform. You will implement Secure SDLC, threat modeling, and strong vulnerability remediation across our software stack, collaborating with developers to embed security into development.

Ideal candidates bring 6+ years in app security, experience with OWASP Top 10, and hands-on coding in Python/Go/Java/JavaScript. You will drive security automation and guidelines across CI/CD pipelines.

Qualifications

• 6+ years of experience in application security.
• Strong knowledge of OWASP Top 10 and mitigations.
• Experience with secure coding practices in languages such as Python, Go, Java, or JavaScript.
• Proficiency in Go or Python with willingness to learn Go if necessary.
• Hands-on security experience.

Responsibilities

• Build and maintain Application Security Posture Management (ASPM) at Nebius scale.
• Automate and support SAST, SCA tools in CI/CD pipelines.
• Improve SAST, secrets detection rules; keep false positives low.
• Identify, analyze, and remediate application security vulnerabilities.
• Collaborate with development teams to integrate security into the SDLC.
• Develop and maintain secure coding guidelines for development teams.
• Conduct threat modeling and risk assessments for new and existing applications.
• Provide development teams with security tooling like threat modeling and vulnerability detection.
• Stay updated on security threats and mitigation techniques.
• Serve as an application security SME to other teams.

Skills

Application security experience

Threat modeling

CI/CD security

Secure coding

Tools

Python

Go

Java

JavaScript

Job description

Nebius is seeking a Senior/Staff Application Security Engineer to safeguard our cloud platform. You will implement Secure SDLC, threat modeling, and strong vulnerability remediation across our software stack, collaborating with developers to embed security into development.

Ideal candidates bring 6+ years in app security, experience with OWASP Top 10, and hands-on coding in Python/Go/Java/JavaScript. You will drive security automation and guidelines across CI/CD pipelines.